Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Refusing all cookies, still targeted by ads. How?

news.ycombinator.com

Post reply on HN
Print view View original

111–118 of 118 posts

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#111

Post by cccbbbaaa »

derefr wrote: post #100
dmattia wrote: post #43

Earlier quoted context omitted.

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws…

How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.

Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#112

Post by Thorrez »

cccbbbaaa wrote: post #74
Thorrez wrote: post #69

Earlier quoted context omitted.

That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.

If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.

Yes GDPR applies, but the part that I was replying to doesn't.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#113

Post by cccbbbaaa »

kzzzznot wrote: post #104
derefr wrote: post #100

Earlier quoted context omitted.

How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.

I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.

Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find.

> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#114

Post by code_duck »

digging wrote: post #70
code_duck wrote: post #63

Earlier quoted context omitted.

Simply using Firefox is a problem in that regard. I think most recent number I saw for Firefox usage was 1%.

Yes, that's true. I think Firefox now tries to hide itself by sending a false user agent? Everything is a trade-off though... using a version of firefox that's closer to stock is probably helping a tiny bit. Or maybe it's not, since Firefox wants people to use plugins (and for some reason, doesn't warn of the dingerprinting danger).

Mine currently says Firefox in it. You can override it without a plugin in the about:config setting general.useragent.override.

I would expect that any reasonably sophisticated fingerprinting system would not rely primarily on the useragent, and agree that anything that isn't stock only serves to distinguish you further.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#115

Post by awinter-py »

brucethemoose2 wrote: post #47
awinter-py wrote: post #26

Earlier quoted context omitted.

can you say why degoogled chromium matters for tracking, or link to a writeup?

The Ungoogled Chromium project itself is a pretty good summary. In a nutshell, Chromium (whether signed in or not) "phones home" to Google for a number of reasons, and the official Chrome builds do it even more (though in harder to observe ways since the changes are closed source). https://github.com/ungoogled-software/ungoogled-chromium

whoa fascinating -- I tried ungoogled chromium a while ago and it has come a long way

it looks like some of their patches are now built into debian? Like on this list:

https://udd.debian.org/patches.cgi?src=chromium&version=114....

disable/signin.patch seems to reference the ungoogled chromium repo

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#116

Post by Sundeepsharma01 »

Refusing all cookies alone may not completely prevent you from being targeted by ads. While cookies play a significant role in tracking user behavior and serving targeted ads, there are other methods that advertisers and platforms can use to target users. Here are a few reasons why you might still see targeted ads even if you refuse all cookies:

1. Device Fingerprinting: Advertisers can use techniques such as device fingerprinting to gather information about your device, browser settings, operating system, and other characteristics. This information can be used to create a unique identifier for your device, allowing advertisers to target you with ads based on your device's attributes rather than relying on cookies.

2. IP Address Tracking: Your IP address is a unique identifier assigned to your device when connected to the internet. Advertisers can use your IP address to approximate your location and deliver ads based on your geographic location.

3. Behavioral Tracking: While cookies are commonly used for behavioral tracking, advertisers can also use other methods like pixel tags, web beacons, and JavaScript code to track your online activities across websites. These techniques allow advertisers to monitor your browsing behavior and serve targeted ads based on your interests and preferences.

4. Contextual Targeting: Advertisers may rely on contextual targeting, which involves analyzing the content of the web pages you visit or keywords used in search queries to determine relevant ads to display. This approach doesn't necessarily rely on cookies or personal data but focuses on the context of the content you engage with.

5. Data from Third-Party Sources: Advertisers may obtain data from third-party sources such as data brokers, social media platforms, or other online services. These data sources can provide information about your interests, demographics, or browsing history, enabling advertisers to target you with personalized ads even if you refuse cookies.

It's important to note that different platforms and advertising networks have varying approaches to ad targeting and user tracking. While refusing cookies can reduce the effectiveness of certain tracking methods, it may not completely eliminate all targeted advertising.

To enhance your privacy and reduce targeted ads, you can consider additional measures such as using browser extensions or privacy-focused browsers, enabling ad blockers, adjusting privacy settings on your devices and online accounts, and being cautious about the information you share online.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#117

Post by kzzzznot »

cccbbbaaa wrote: post #113
kzzzznot wrote: post #104

Earlier quoted context omitted.

I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.

Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination…

Does an IP alongside a HTTP request count as personal data?

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#118

Post by cccbbbaaa »

kzzzznot wrote: post #117
cccbbbaaa wrote: post #113

Earlier quoted context omitted.

Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination…

Does an IP alongside a HTTP request count as personal data?

An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/r...
Post reply on HN